Django Project Django 1.10.2
Approved changes feed: RSS · Atom
cpe:2.3:a:djangoproject:django:1.10.2:*:*:*:*:*:*:*
part: a version: 1.10.2 update: *
| Vendor | Djangoproject (070db687-4713-5da4-80b0-4a67baf0d0d4) |
|---|---|
| Product | Django (b34a5fd0-fae8-5096-941f-bded7e4dd228) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/django/django |
purl2cpe | 2026-06-01 10:17:26.721552 |
pkg:github/django/django |
purl2cpe | 2026-06-01 10:17:26.721554 |
pkg:pypi/django |
purl2cpe | 2026-06-01 10:17:26.721556 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2017-7234 |
vulnerable | 2026-06-08 05:09:55.522664 |
Details available
A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.
Published: 2017-04-04T17:00:00.000Z
Updated: 2024-08-05T15:56:36.057Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7233 |
vulnerable | 2026-06-08 05:09:55.519314 |
Details available
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.
Published: 2017-04-04T17:00:00.000Z
Updated: 2024-08-05T15:56:36.158Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-12794 |
vulnerable | 2026-06-08 05:08:47.891421 |
Details available
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.
Published: 2017-09-07T13:00:00.000Z
Updated: 2024-08-05T18:51:07.127Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9014 |
vulnerable | 2026-06-08 05:08:22.419961 |
Details available
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
Published: 2016-12-09T20:00:00.000Z
Updated: 2024-08-06T02:35:02.332Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9013 |
vulnerable | 2026-06-08 05:08:22.397662 |
Details available
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
Published: 2016-12-09T20:00:00.000Z
Updated: 2024-08-06T02:35:02.828Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.